tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
"Five fixes, all in drivers.

The big change is the UFS task management rework, with lpfc next and
the rest being fairly minor and obvious fixes"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
scsi: iscsi: Fix iscsi_task use after free
scsi: lpfc: Fix memory overwrite during FC-GS I/O abort handling
scsi: elx: efct: Delete stray unlock statement
scsi: ufs: core: Fix task management completion
scsi: acornscsi: Remove scsi_cmd_to_tag() reference

Linus Torvalds 0950fcbf 50eb0a06

+41 -43
+1 -1
drivers/scsi/arm/acornscsi.c
··· 1776 1776 host->scsi.disconnectable = 0; 1777 1777 if (host->SCpnt->device->id == host->scsi.reconnected.target && 1778 1778 host->SCpnt->device->lun == host->scsi.reconnected.lun && 1779 - scsi_cmd_to_tag(host->SCpnt) == host->scsi.reconnected.tag) { 1779 + scsi_cmd_to_rq(host->SCpnt)->tag == host->scsi.reconnected.tag) { 1780 1780 #if (DEBUG & (DEBUG_QUEUES|DEBUG_DISCON)) 1781 1781 DBG(host->SCpnt, printk("scsi%d.%c: reconnected", 1782 1782 host->host->host_no, acornscsi_target(host)));
+1 -2
drivers/scsi/elx/efct/efct_scsi.c
··· 32 32 struct efct *efct; 33 33 struct efct_xport *xport; 34 34 struct efct_io *io; 35 - unsigned long flags = 0; 35 + unsigned long flags; 36 36 37 37 efct = node->efct; 38 38 ··· 44 44 if (!io) { 45 45 efc_log_err(efct, "IO alloc Failed\n"); 46 46 atomic_add_return(1, &xport->io_alloc_failed_count); 47 - spin_unlock_irqrestore(&node->active_ios_lock, flags); 48 47 return NULL; 49 48 } 50 49
+9 -6
drivers/scsi/libiscsi.c
··· 2281 2281 return FAILED; 2282 2282 } 2283 2283 2284 - conn = session->leadconn; 2285 - iscsi_get_conn(conn->cls_conn); 2286 - conn->eh_abort_cnt++; 2287 - age = session->age; 2288 - 2289 2284 spin_lock(&session->back_lock); 2290 2285 task = (struct iscsi_task *)sc->SCp.ptr; 2291 2286 if (!task || !task->sc) { ··· 2288 2293 ISCSI_DBG_EH(session, "sc completed while abort in progress\n"); 2289 2294 2290 2295 spin_unlock(&session->back_lock); 2291 - goto success; 2296 + spin_unlock_bh(&session->frwd_lock); 2297 + mutex_unlock(&session->eh_mutex); 2298 + return SUCCESS; 2292 2299 } 2300 + 2301 + conn = session->leadconn; 2302 + iscsi_get_conn(conn->cls_conn); 2303 + conn->eh_abort_cnt++; 2304 + age = session->age; 2305 + 2293 2306 ISCSI_DBG_EH(session, "aborting [sc %p itt 0x%x]\n", sc, task->itt); 2294 2307 __iscsi_get_task(task); 2295 2308 spin_unlock(&session->back_lock);
+7 -4
drivers/scsi/lpfc/lpfc_sli.c
··· 12292 12292 lpfc_ignore_els_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 12293 12293 struct lpfc_iocbq *rspiocb) 12294 12294 { 12295 - struct lpfc_nodelist *ndlp = (struct lpfc_nodelist *) cmdiocb->context1; 12295 + struct lpfc_nodelist *ndlp = NULL; 12296 12296 IOCB_t *irsp = &rspiocb->iocb; 12297 12297 12298 12298 /* ELS cmd tag <ulpIoTag> completes */ 12299 12299 lpfc_printf_log(phba, KERN_INFO, LOG_ELS, 12300 - "0139 Ignoring ELS cmd tag x%x completion Data: " 12300 + "0139 Ignoring ELS cmd code x%x completion Data: " 12301 12301 "x%x x%x x%x\n", 12302 12302 irsp->ulpIoTag, irsp->ulpStatus, 12303 12303 irsp->un.ulpWord[4], irsp->ulpTimeout); ··· 12305 12305 * Deref the ndlp after free_iocb. sli_release_iocb will access the ndlp 12306 12306 * if exchange is busy. 12307 12307 */ 12308 - if (cmdiocb->iocb.ulpCommand == CMD_GEN_REQUEST64_CR) 12308 + if (cmdiocb->iocb.ulpCommand == CMD_GEN_REQUEST64_CR) { 12309 + ndlp = cmdiocb->context_un.ndlp; 12309 12310 lpfc_ct_free_iocb(phba, cmdiocb); 12310 - else 12311 + } else { 12312 + ndlp = (struct lpfc_nodelist *) cmdiocb->context1; 12311 12313 lpfc_els_free_iocb(phba, cmdiocb); 12314 + } 12312 12315 12313 12316 lpfc_nlp_put(ndlp); 12314 12317 }
+22 -30
drivers/scsi/ufs/ufshcd.c
··· 6377 6377 return retval; 6378 6378 } 6379 6379 6380 - struct ctm_info { 6381 - struct ufs_hba *hba; 6382 - unsigned long pending; 6383 - unsigned int ncpl; 6384 - }; 6385 - 6386 - static bool ufshcd_compl_tm(struct request *req, void *priv, bool reserved) 6387 - { 6388 - struct ctm_info *const ci = priv; 6389 - struct completion *c; 6390 - 6391 - WARN_ON_ONCE(reserved); 6392 - if (test_bit(req->tag, &ci->pending)) 6393 - return true; 6394 - ci->ncpl++; 6395 - c = req->end_io_data; 6396 - if (c) 6397 - complete(c); 6398 - return true; 6399 - } 6400 - 6401 6380 /** 6402 6381 * ufshcd_tmc_handler - handle task management function completion 6403 6382 * @hba: per adapter instance ··· 6387 6408 */ 6388 6409 static irqreturn_t ufshcd_tmc_handler(struct ufs_hba *hba) 6389 6410 { 6390 - unsigned long flags; 6391 - struct request_queue *q = hba->tmf_queue; 6392 - struct ctm_info ci = { 6393 - .hba = hba, 6394 - }; 6411 + unsigned long flags, pending, issued; 6412 + irqreturn_t ret = IRQ_NONE; 6413 + int tag; 6414 + 6415 + pending = ufshcd_readl(hba, REG_UTP_TASK_REQ_DOOR_BELL); 6395 6416 6396 6417 spin_lock_irqsave(hba->host->host_lock, flags); 6397 - ci.pending = ufshcd_readl(hba, REG_UTP_TASK_REQ_DOOR_BELL); 6398 - blk_mq_tagset_busy_iter(q->tag_set, ufshcd_compl_tm, &ci); 6418 + issued = hba->outstanding_tasks & ~pending; 6419 + for_each_set_bit(tag, &issued, hba->nutmrs) { 6420 + struct request *req = hba->tmf_rqs[tag]; 6421 + struct completion *c = req->end_io_data; 6422 + 6423 + complete(c); 6424 + ret = IRQ_HANDLED; 6425 + } 6399 6426 spin_unlock_irqrestore(hba->host->host_lock, flags); 6400 6427 6401 - return ci.ncpl ? IRQ_HANDLED : IRQ_NONE; 6428 + return ret; 6402 6429 } 6403 6430 6404 6431 /** ··· 6527 6542 ufshcd_hold(hba, false); 6528 6543 6529 6544 spin_lock_irqsave(host->host_lock, flags); 6530 - blk_mq_start_request(req); 6531 6545 6532 6546 task_tag = req->tag; 6547 + hba->tmf_rqs[req->tag] = req; 6533 6548 treq->upiu_req.req_header.dword_0 |= cpu_to_be32(task_tag); 6534 6549 6535 6550 memcpy(hba->utmrdl_base_addr + task_tag, treq, sizeof(*treq)); ··· 6570 6585 } 6571 6586 6572 6587 spin_lock_irqsave(hba->host->host_lock, flags); 6588 + hba->tmf_rqs[req->tag] = NULL; 6573 6589 __clear_bit(task_tag, &hba->outstanding_tasks); 6574 6590 spin_unlock_irqrestore(hba->host->host_lock, flags); 6575 6591 ··· 9620 9634 if (IS_ERR(hba->tmf_queue)) { 9621 9635 err = PTR_ERR(hba->tmf_queue); 9622 9636 goto free_tmf_tag_set; 9637 + } 9638 + hba->tmf_rqs = devm_kcalloc(hba->dev, hba->nutmrs, 9639 + sizeof(*hba->tmf_rqs), GFP_KERNEL); 9640 + if (!hba->tmf_rqs) { 9641 + err = -ENOMEM; 9642 + goto free_tmf_queue; 9623 9643 } 9624 9644 9625 9645 /* Reset the attached device */
+1
drivers/scsi/ufs/ufshcd.h
··· 828 828 829 829 struct blk_mq_tag_set tmf_tag_set; 830 830 struct request_queue *tmf_queue; 831 + struct request **tmf_rqs; 831 832 832 833 struct uic_command *active_uic_cmd; 833 834 struct mutex uic_cmd_mutex;